CVE-2026-19484

creationtimestamp| type| source ---|---|--- 2026-08-13 09:01:22+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3msxbtcdfrk2l 2026-08-13 13:40:34+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msxrglp6u42g...

CVE-2026-19484 @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256...

CVE-2026-19484

@fastify/busboy versions 3.1.0–3.2.0 are vulnerable to a Denial of Service via crafted multipart boundaries. The root cause is a fixed 256-entry skip table in the vendored streaming search; a boundary of exactly 252 bytes makes the search needle 256 bytes, truncating the skip distance to zero and...